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ro t * 8 ECUET//SI//NOrORN 
NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE MARYLAND 20755-6000 

28 September 2011 


MEMORANDUM FOR THE CHAIRMAN. [NTELLIGENCE OVERSIGHT BOARD 


THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT; (U//F0UO7 Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 


(U/ /rOUO) Except as previously reported to you or the President, or otherwise stated in the 
enclosure, we have no reason to believe that intelligence activities of the National Security Agency 
during the quarter ending 30 June 2011 were unlawful or contrary to Executive Order or Presidential 
Directive and thus should have been reported pursuant to Section 1.6(c) of Executive Order 12333, as 
amended. 


(U//l‘OUO) The Inspector Genera) and the General Counsel continue to exercise oversight of 
Agency activities by inspections, surveys, training, review of directives and guidelines, and advice and 
counsel. These activities and other data requested by the Board or members of the staff of the Assistant 
to the Secretary of Defense (Intelligence Oversight) are described in the enclosure. 


GEORGE EULARD 
Inspector General 



Acting General Counsel 


concur in the report of the Inspector General and the General Counsel and hereby 
make it our combined report. 



General, U. S. Army 
Director, NSA/Chief, CSS 


Enel: 

Quarterly Report 

This document may be declassified and marked 
^•UNCLASSlFlED //roi OffiLidl UsL On l y” 
upon removal of enclosure(s) 

Pipproved for Release bv NSA on 12-22-2014, FOIA Case # 70809 (Litigation) 
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(b) (1 
(b) (3 
(b) (3 


I. (U) Intelligence, Counterintelligence, and Intelligence-Related Activities that 
Violated Law, Regulation, or Policy and Were Substantiated during the 
Quarter, as well as Actions Taken as a Result of the Violations 

A. (U) Intelligence Activities Conducted under Executive Order (E.O.) 12333 
Authority 

(U) Unintentional Collection against United States Persons (USPs) or Foreign 
Persons in the United States 


During the second quarter of calendar year 2011 (CY20i 1). signals 
intelligence (SIGINT) analysts in i I instances inadvertently targeted or collected 
communications to. from, or about USPs while pursuing foreign intelligence tasking. Unless 
otherwise specified, all intercepts and reports have been deleted or destroyed as required by 
United States SIGINT Directive (USSID) SP0018. 


(b) {3)-P.L. 86-36 


1. (U) Targeting 


_during a revie w of tasked selectors. aiiNSA analyst 

discovered that selectors had been tasked for i_Ifo reien intelliuence taruets locate d in the 

The 


United States. The erro r occurred |_ 
selectors were detasked 

that should not be tasked. No collection occurred. 


^nd were entered into a database containing selectors 


NSA analysts learned that the selectors tasked on behalf of 


an Intelligence Community (IC) customer were associated with a USP. The error occurred 
because NSA analysts d id not research th e selectors before submitting them for tasking. The 
selectors were detasked 


databases. 


and all collection was purged from the 1C customer's 


(U//P€)UO) On | O ccasions 


^NSA analysts learned that 


selectors for valid foreign intelligence targets remained on task w hile th e targets were in the 
United States. The selectors were detasked in all instances except ! 1 for which the targets had 
already departed the United States. No collection occurred. 


f G/ZRCL TO U9 A. FVE^ ‘1 Oni~~loccasions betwee r{ 


SIGINT 


analysts discovered that 


asso ciated with a U S military 

installation had been targeted. All data collected was delet^ by | | and no reports 

were issued 


(S //REL TO USA. FVEY) | | an NSA analyst learned that the selectors 

fo H Ivalid foreign intelligenc e targets remained on task w hile the targets we re in the United 
Statesl I The selectors were detasked | " | and no reports 


) 

)-P.L. 86-36 
)-50 use 3024(i) 


(b) (1) 

(b)(3)-P.L. 86-36 


Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20320108 
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weie issued 


(b) (1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 use 3024 (i) 



('5//REL TO USA. rVC^r) | I anNSA anaJyst learned that the selector for a 

valid foreign intelligence target remained on task while the target was in the United States f rom 


I I The selector was 

detasked i 1 collection was deleted and no reports were issued. (h)(1) 

-_ (b)(3)-P.L. 86-36 

(U//rOUO) _ an NSA analyst learned that a USP had been targeted. The 

error occurre d because the task ing analyst was unaware ofthe tanzet' s USP status. The selector 
was detasked | | The amount of collection ! ~| No reports were issued. 

(!i RfL TOUSA. rVCYi r I NSA (b)(3)-P.L. 86-36 

analysts discovered that selectors for valid foreign intelligence targets remained on task after the 
targets had traveled to the United States. The targets' selectors under the Foreign Intelligence 
Surveillance Act (FISA) Amendments Act Section 702 (FAA vj702) authority had been detasked 


I I Collection resulted from one ofthe selectors. The selectors were 

detasked. and no reports were issued. 

(h)(1) _ (b)(3)-P.L. 86-36 

(b)(3)-P.L. 86-36 (TS//SI// NH | |an NSA analyst targeted the e-mail r(biil (3)-5Q USC 3024(i) 

telephone selectors of a foreianl I 

I j n accordance with USSID SPOO18. The 

error was caused by the analyst's co nfusion about SIGINT authorities. No collecti on occurred. 

The analyst also incorrectly targeted !" See a related 

incident under “Reverse Targeting” on page 9. 

(U//F 0UO ) anNSA analyst discovered that ] | USPs had been targeted 

and that their identities were contained in a presentation. Analysts detasked the selectors and 
removed the USP information from the presentation slides ! 

(U// FOU 0) | I an NSA analyst discovered that selectors for a valid (b) (3) -p.l. 8 6-36 

foreign intelligence target remained on task while the target was in the United States from 
I I No detasking occurred because the target had already left the United States 

when the incident was discovered. No reports were produced from the data collected while the 
target was in the United States. 

2. (U) Database Queries 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(S//RCL TO UGA. FVCY) Oii l l occasions during this quarter, analysts performed 
overly broad or poorly constructed database queries that potentially targeted USPs. These 
queries u sedi 

Jthat produced imprecise results. On| |of those 


occasions, the queries returned results from the database. The query results were deleted, and no 
reports were issued Analysts who performed these queries were counseled by their 
manaaement. 

(b)(1) 


(U) Procedural errors contributed to the following incidents. 


(b)(1) 

(b)(3)-P.L, 86-36 


(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(S//REL TO USA. FVEV) | | an analyst pursuing information on a valid 

^ foreign intelligence target attempted to confirm[~ 


were issued. 


The query and results were deleted, and no reports 


(U/ffi OUQ) [ 


an NSA analyst queried a raw traffic database 


as a query term. The query and results were deleted 
were issued. 


and no reports 


"'■(b)(3)-P.L. 86-36 






an NSA analyst discovered that | 

]that had been detaskeclL 


when it was determined to be associated with a USP . The analyst was 
not aware titat. ni addition to the selector being detasked . | 

The query and results were deleted! 


were issued. 


. and no reports 


(U//FOUO) i | NSA analysts performed (b)(1) 

queries in raw t raffic databases without first performing the required research on the twwr.i.. oo-oo 
selectors. | |queties returned results, which were deleted, and no reports were issued 


(6//REL TO USA. FVGV) [ 


3 a database auditor discovered that an NSA 


analyst queried selectors associated with a FISA §705(b) target for which the Foreign 
Intelligence Surveillance Court (FISC) Order had expired ! I The error 

occurred because a previous analyst had created a query for val id FAA ^705(b) targets 
using an outdated list of selectors. A new analyst ran the query ! 
without verifying the selectors; the query returned no results. 


(S//PlFL to USA. FVF ¥^ 


an NSA analyst queried 


l in a raw traffic database. The err or occurred because the analyst did not use 
a\ailable tools ! { before performing the query. No traffic was 

retained from the queries. | | another NSA analyst queried ! ~ 


The analyst deleted the results without viewing them. No reports vygjpi) 
issued from the data. (b)(3)-P.L. 86-36 

_ (b)(3)-50 use 3024(i) 

(TS//S1//NF) _ an NSA analyst ran | { queries in a ra w traffic database 

containing E.O. 12333 collection, using selectors associated with foreign 


TOP GCCRET'.Ol/TJOrORN 


(b)(1) 

(b)(3)-P.L. 86-36 
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The queries and results were deleted 


reports were issued. 
(GZ/RCLTOUGA. FVCY) 


and no 


I an NSA analyst queried th e name of a valid 
foreign intelligence target while t he target was in the United State s fioin | 1 

] While performing research ^ [the United States, the 


analyst performed the query in a raw traffic database [ 


(b)(1) 

(b)(3)-P.L. 86-36 


] The error was identified the same day. and query results 


were deleted. No selectors were tasked or queried, and no reports were issued. 

|an NSA analyst queried a selector for a valid foreign 



(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


a raw traffic database. The error occuned because the analyst, who was unfamiliar with 
the database. 


No results were returned by the two queries. 


(SZ/REL TO UGA. rVCY) [ 


3 an analyst-in-training performed a query on 


I | U S. telephone selectors in a raw traffic database. The error occurred because the 
(b)( 1 ) analyst had not been folly trained to validate the selectors before submitting queries to 

(b)(3)-P.L. 86-36 raw traffic databases. The results were deleted. and no reports were issued. 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18USC 798 
(b)(3)-50 use 3024(i) 



(5//RCL TO USA. F\'EY) 


database l 

recognize initially thatj t>fthe selectors f 


a SIGINT analyst queried a raw traffic (b)(1) 

- (b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)'50*'usc^3^024(i) subsequently deleted the results and modified the query on 


1 The analyst, who did n ot 


were issued. 

(S/VRCL TO USA. FVCY) [ 


jNo reports 


3 database auditor discovered that I I 


^associated with a U.S. ten itoiy were included on a list of selectors that we re 


queried in a raw traffic database. 


The results were deleted, and no reports were issued. 


(S//PtEL TO USAi FVEY) | | an NSA analyst discovered that the e-mail 

selector associated with a USP ha d been queried in a raw t raffic database. A lthough the 
selector had been removed from a | ]query| [after the 

target traveled to the United States, the selector ] 

(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


2011. an NSA analyst mistakenly 
query and results were delved, and no reports were issued 


The 


(b)(3)-P.L. 86-36 


(U/ /FOU ^ ) r 

raw tra ffic database queriesj 
that the[ 


1 an NSA analyst learne d that a USP had been targeted in 

I T he error occurred despite the fact 
Jthat should have prevented the 


targeting of the USP The release of a new version of the tool has resolved the problem 
No reports were issued. 

(b)(1) 

3. (U) Overcollection ll'lL 

' ' (b)(3)-18 use 798 

(S ' RCL TO USA. rVCVi r I NSA/CSS discov ered that an 2°24(i) 

overcollection ofE.O. 12333-acquired data occurredi [after an upgrade had 

been installed. 



4. (U) Detasking Delays 

(S//RCL TO FV F V l T I du ring a review of detasking requests at an 

E 0. 12333 collection site. NS.4 (TSS foun d that| [ selectors associated with USPs had not 
been detasked There was no collection foi l l ofthe selectors. The remaining | [ selectors 
had collection results at various sites. NSA/CSS is analyang the collection to determine whether 


purging is required. 


( S //R6L TO USA. FVGY )[ 


]during a meetin g with IC per sonnel, an 


■'(b)(1) 

(b)(3)-P.L. 86-36 


NSA a nalyst learned that a target had been in the Unite d States sin^ I Another NSA 


analyst.! 

selectors! 


However. 


There was no collection or reporting on the target between [ 


( had detaskec f 
elector remained on task until |_ 


J 


(S//REL TO CSA. rVTV ) 


an NSA analyst discovered that a selector 


associated with a valid foreign intelligence target who had traveled to the United States had 

_^even though the analyst had submitted a request to 


remained on task^ 
detask the selector. 


in the United States from^ 
and no reports were issued. 

5. (U) System Errors 


5 .11 intercept collected from the target's arrival 
(the date ofthe last collection) was deleted. 


(b)(1) 

(b)(3)-P.L. 86-36 


(0//aCLTOUSA. rVCY) 


while participating in a test and evaluation 


session for a development system, an NSA analyst performed a search for 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 


I Tlie analyst submitted a request to the system developer to correct the problem and 
notified other test and evaluation participants of the software error. The analyst did not view the 

results. (b)(1) 

(b)(3)-P.L. 86-36 

(WRLL TO USA. FVEV) | l anNSA analyst performed a q uery in a raw 

traffic database that returned U.S data The error was caused by a software fea ture f 1 

I I The analyst 

immediately recognized the mistake and reported the system error to the database developers. 

The query returned results that have aged off No reports were produced. The software problem 
is under review by the developers. (b)(1) 


6. (U) 


(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(b)(3)-P.L. 86-36 
(b)(3)-18USC 798 
(b)(3)-50 use 3024(i) 



7. (U) Data-Handling Errors 

(U/ /FOUO) I a n NSA analyst disseminated to an IC agency analyst ra\(b)(3)-P.L. 86-36 

SIGINT coniain inti tlie identities ofl I USPs. The analyst verified recall of the information on 


(G//M2L TO U9A: FVEV) | l anNSA analyst dis covered that a target was 

a USP. requiring all collection beinu shared with an 1C agency to ceas e. l ~| 

I i TIie data sharing was 

terminated the same day. The IC agency confirmed that all information received on the target 
was purued I I (b)(1) 

(b)(1) ■ '-' ,_, 

(b)(3)-18 use 798 (TS//S1//IUIL TO USA. FVE\) | I an NSA analyst learned that a target 

selector cited in an NSA/CSS reoon and used in a raw traffic database query was beine used by 


(b)(3)-P.L. 86-36 


I A destruction waiver is being requested. 

(S//REL TO USA. FVEY) | an NSA analyst forwarded an e-mail to an 

IC agency analyst and an NSA analyst containing the identity of a U.S. company without going 
through proper identity r elease proced ures Both the IC and NSA analysts confirmed deletion of 
the coniniunication as ofl I There was no tarsetins or collection. 
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B. (U) Dissemination ofU.S. Identities 


0//RIL TO UGA. nTY) The NSA/CSS enterprise issued I SIGINT product 
reports during the second quarter ofCY2011. In th ose repo rts. SIGINT analysts included 
information that identified USPs or U.S. entities on l I occasions while pursuing foreign 


(b)(1) 

(b)(3)-P.L. 86-36 


and the reports were canceled as NSA/CSS 
U.S. organizations, or U.S. entities named without authorization. 


intelligence tasking. ln | [ SIGINT produ cts, such disseminations w ere found to be improper. 

janalysts learned ofUSPs. 
^Irdata in the canceled reports 
was deleted as required, and the reports were not reissued or were reissued with proper 
minimization. It should be noted that the majority ofthe U.S. entities’ names identified were 
those of Internet service providers in e-mail selectors. 


C. (U) Foreign Intelligence Surveillance Act (FISA) 
1. (U) NSA/CSS Title I FISA 


a. (U) Tasking Error 


(S//aCLTOUSA. FVCV) 


NSA/CSS determined that a FISC Order 


contained an incorrect telephone number for a targeted entity. The error occur red because the 
source of the information was inaccurate. The telepho ne number was detasked f 

was deleted, and no reports were issued. 


b. (U) Detasking Delays 

( 3//pi:l to u!v-\. r\ iiv ir 


'(b)(1) 

(b)(3)-P.L. 86-36 


an NSA analyst discover ed an e-mail 

The e-mail 


selector for this FISC-authorized t arget remained on task after the target had left the United 
States. The selector was detaskedf 1 another analyst 


documented this as an instance of overcollection . Data that w as collected and retained 
I 1 data was purged I 

discussion with oversight personnel. No reports were issued 


i while the incident was under 


(S/ZRCL TO U 5A. FVEY ir 


_ _an NSA database auditor discovered that 

the sel ectors fod Iforeign targe ts authorized under FISC Orders remained on task after the 
laruetsl departed the United States. | l ofthe targets had departed 

Jdeparted F | The selectors were detasked 

.(b)(1) 

(b)(3)-P.L. 86-36 


ai 




on 2 March 2011. and no collection occurred. 


(G//RCL TO USA. FVCY) F I an N SA analyst learned th at the selector 

for a FlSC-ap proved target rem ained on task after the target ) ^ departed the 

United States 1 I Improved procedures for tracking the target selectors have been 


formulated. The selector was detasked [ 


has been purged. No reports were issued. 


and collection 


(S//RCL TO USA. rVCY) ( 


an NSA analyst discovered that the 


selectors for| [foreign targets authorized under FISC Orders had remained on task after the 


(b)(1) 

(b)(3)-P.L. 86-36 


TOP SE<r - R£T//SI//NOrORI»/ 
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targets | _Jdeparted the United States ) 

the selectors collected after the targets' departure dates was purged 


Traffic from 


(b)(3)-P.L. 86-36 


an NSA analyst learned that the e-mail 


selecto r for a FlSC-authorized t araet had remained on task after the target had left ) 

I United States on or about ) | The e-mail selector was detasked on ) ~ 

Collection from the e-mail selector has been marked for purging 

(S^/RCL TO USA. FVEYl P I during a review of selectors for the renewal 

of a FISC Order, an NSA analyst learned th at e-mail selectors fori IFISC-authoriz ed targets 
remained on task after the targets’ departure f | The 

selector for o ne of the targets remained on task three days after the target’s departure from the 
United States | 

I I Traffic 

collected from| |was purged, and no reports were issued. 


c. (U) Data-Handling Errors 


(b)(1) 

(b)(3)-P.L. 86-36 


(U//FOUOj I files containing FISA records were downloaded into an 

E 0. 12333 database. Within three hours of the download, the error was discovered, and the 
FISA records were deleted from the database. No FISA records were accessed during the time 
the data was in the database. 


{b)(3)-P.L. 86-36 


(U//£0«0T 


a SIGINT analyst posted FISA information to a chat 


window that was not authorized for FISA data. The analyst notified his overseers of his mistake. 
Chat posts age off after 48 to 72 hours. 

d. (U) Unauthorized Data Retention 

(U//F0UO)_system developers discovered system errors that had 

prevented the purging of records containing FISA data after the one-year retention period. The 
system error was corrected, and a new automated script was implemented | to 

delete FISA files older than one year. 

(U/ZEOUer l I previously m isidentified files were processed and found to 

contain FISA data from ) I that was no longer approved for retention 

under expired FISC Orders. Although the data was authorized under FISC Orders when it was 
collected, the data was pro cessed and reta ined in the database after the Orders had expired. All 
data had been purged as of] ) and no reports were issued. 


2. (U) 


(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(U) Nothing to report 


lusiness Records (BR) Order 


(U) Nothing to report 


8 
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4. (TS//SI//MF)- Pen Register/Trap and Trace (PR/TT) Order 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 




5. (U) FISA Amendments Act (FAA) 
a. (U) Section 702 

(U/ /FOUQ) Note: As previously reported in the 2010 Second Quarter Report. NSA CSS has 
implemented a new process t o ensure the oureins of FAA >>702 collection that is required to he inireed 
from NSA ('SS databases. A I I 


\ fo identiR noncompliani data that .'should he onived. 
All collection that has been marked for purging will be purged. 


\. (U) Unauthorized Targeting 


(b)(3)-P.L. 86-36 


(S//R.EL TO UGA. TVCY) | [ NSA/CSS detasked a selector associated 

with a valid foreign intelligence target a fter it was determine d that the target was in the United 

States The seleaor was initially tasked I I The error occurred because the _ 

analyst overlooked information t hat the target h ad arrived in the United States sometime aft ei i I 

I I the traffic from [ after 

detasking. ensuring removal of all data from Agency databases) was quarantined, pending (b)( 1 ) 
approval of a destruaion waiver. No reports were issued. (b)(3)-P.L- 86-36 

(S//REL TO USA. FVEY) j I an NSA analyst discovered that the e-mail 


accoun t associated with a valid foreign intelligence targetl 
States. I 


[the United 

^)( 1 ) 

-(b)(3)-P.L. 86-36 

(b)(3)-18 use 798 
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(b)(3)-K.L. 86-36 
(b)(3)-18USC 798 


and collection froml 


I The selector was detasked on 
I had been marked for purging. No reports 


were issuec 


ii. (U) Reverse Targeting 


(b)(1) 

(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


(TS//Slii7N^ I I NSA/CSS learned of an instance of reverse targeting. For 

the purpose of collecting information on a foreign i B ocated in the United States, 

an analyst targeted selectors associated with the target's family members. The re was no 
independent foreitzn intelliuence interes t in the famil y members. The selectorsj | 

T we re detasked ! 11 j 

associated with the selectors were deleted | | Collection resulting from the 

FAA §702 selectors has been marked for purging. No reports were issued. 

iii. (U) Tasking Errors 

(U//rOUO) On | O ccasions from | NSA analysts discovered 

that incorrect e-mail selectors had been tasked because oftypographical errors. The selectors 
were detasked. and all noncompii ant collection was marked for purging, 

(U// FOL. i O j j an NSA analyst discovered that a previously tasked selector 

had been retasked on j .vithout having gone through the required pre-tasking 

approval process. The selec tor was not detask ed, but the tasking infor mation was updated, and 

the tasking was re-approved! | Collection for the period_ 

was purged^ ! 


(U' /FQUQ) 


an NSA analyst discovered that a selector had been tasked 


corrected 


under the incorrect FAA §702 Certifi cation. The incorrec t tasking was 
I and all results were purged! I 


""Cb)(3)-P.L. 86-36 


(U/?FeW©) On! ! occasions froni r [ NSA analysts tasked 

selectors without providing sufficient pr oof th at the targets were located outside the United 
States All selectors were detasked. On | | occasions. noncompii ant data was collected, and it 
has been marked for purging. No reports were issued. 

(U//fOU OT! selectors were tasked un der FAA §702 authority in 

error as part of a ! I ProcMures for ! I do not require pre-tasking 

review; so th e error was not discovered before tasking. NSA analysts discovered the error on 

^itnd detaske d the selectors from FAA §702 collection the same day. Collection was 
purget ^ and no reports were issued. 

(U/7FeW) | ~ 1 an NSA analyst discovered that a selector had been tasked 

without having gone through the required pre-tasking review process. The error occurred 
because the target's selector was similar to one that was a lready taske d. The selector was no t 
detasked. bu t was updated and approved f ! Collection | 1 

I has been marked for purging. No reports were issued. 


10 
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(U//FOUO) | 1 a selector was erroneously included in a list of selectors (t»)(3)-P.L. 86-36 

being processed for transfer to another NSA analyst. The selector was ineligible for tasking 
under F AA ^702 because o f outdated information about the target’s location. The selector was 
detasked I I There were no results. 


selector. The selector was detasked 
collection! 


I an NSA analyst incorrectly tasked an e-mail 
1 when the correct selector was tasked All 
[has been marked for purging. 


(S/ZREL TO USA. FVCY) | | an NSA analyst attempting to submit 

selectors for FAA §702 collection incorrectly tasked non-FAA §702 sites and routed the 
collection to an IC customer. While FAA §702 minimization procedures allow collection to be 
routed to other IC members, this i s not true o f all SIGINT collection. The se lectors were 
detasked | | Collection | has been marked for 

purging, '"(b)(1) 

(b)(3)-P.L. 86-36 

iv. (U) Database Queries 

(U/ /rOUO) On ! ~| occasionsffom r I NSA analysts queried the (l))(3)-P.L. 86-36 

selectors for valid foreign intelligence targets in a raw traffic database without first conducting 
the required research on the selectors. The queries returned r esults that associated the selectors 
with USPs. The query results were deleted and no reports were issued. 

(UZ/FGUOT Oi j [ occasions from | | NSA analysts submitted 

overly broad queries that could potentially return USP data to databases containing FAA §702 
data. The query results were deleted, and no reports were issued. 

(SZZREL TO L^SA FVEV) From l j anNSA analyst performed a 

query in the FAA §702 j raw traffic database using the e-mail selector for a USP 

associated with the U S. government. The error occurred because the analyst was not aware that 
the account was associated with the U.S. government. No results were returned by the query. 

(0//RCL TO U6j\. r\'[jY) | | a database auditor discovered that an analyst 

had queried FAA §702 data us ing selectors asso ciated with FAA §704 and FAA §705(b) targets. 

The auerv results were deleted I I (b)(1) 

nCL tPO UOA; — PV B' i*) (b)(3)-P.L. 86-36 

(U/ZFOUQt l I a database auditor discovered that an NSA analyst had 

erroneously queried an FAA §704 selector in the FAA §702| jraw traffic database. 

The query and results were deleted. 

V. (U) Detasking Delays 

(U'+OUGI_it was discovered that an F AA §702 selector remained on 

task after a detask request had been issued { The error occurred because a 

collection system processed the detasking requests ou t of order, thereby leaving the select or on 
collection. The selector was removed from collection ! I a 

system patch updated th e collection system to prevent future errors . On j j records 

collected for the selectorP “^were marked for purging. 


(b)(3)-P.L. 86-36 
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(u/ /rQuo r|_ _I it was discovered that an NSA ana lyst failed to detask the 

selectors for a valid foreign intelligence target after receiving instructions |to 

detask because P The selector was detasked | | 

I l and the traffic from I was marked for purging. No reports 

were issued. (b)(1) 

(b)(3)-P.L. 86-36 

"f SiVTl CL TO U GA. rVCV) Because of a co mmunication en gr, information co llected on 

_regarding ! United States was m issed. 

and the selector was not detasked until l ^~| Collection from | | has 

been marked for purging. No reports were issued 

~t5//REL TO UOA. r^TY) i I an NSA analyst discovered that a selector 

remained on task for routing to an 1C customer even though it had been de tasked by NSA/CS S 
I I because ^ | the United StatesI I The 

selector was completely detasked onl I Collection from t (the date ^he 

target entered the United States) to mas been marked for purging. .. 


vi. (U) Data-Handling Errors 


(b)(1) 

(b)(3)-P.L. 86-36 


(U/zTOUQ) On l n occasions from . FAA §702 data was forwarded 

by fax and e-mail to personnel not authorized to receive FAA §702 data. The recipients 
confirmed that the data was not further disseminated and that the faxes and e-mails had been 
destroyed. .••••''■(b)(3)-P.L. 86-36 

(UZ/f'OUO) I I an NSA analyst raised concerns about the appropriateness 

of sharing FAA §702 traffic with an NSA analyst who was detailed to another 1C agency and 
was not cleared for FAA §702. The sharing arrangement began in 2009. The agree ment on the 

shaiin u activity with the 1C agency did not cover sharing FAA-derived information. _ 

I I the analyst cease d information-sha ring until appropriate authorization could be obtained 
The analysts confirmed l [that at no time had source information for the FAA- 

derived information been shared Aso g | NSA/CSS had not created a new memo 

on sharing information with the 1C agency. 


(U/; TOUQ )|_ 

in FAA §702 traffic to a[ 
issued. 


an NSA analyst forwarded unminimized USP information 
3ecipieni The traffic was destroyed, and no reports were 


vii. (U) Overcollection 



(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 
(b)(3)-50 use 3024(i) 
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b. (U) Section 704 
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(b)(1) 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 use 3024(i) 


I. (U) Unauthorized Dissemination (b)(3)-P.L. 86-36 


(5//RCLTOUSA. rVTV) 


an NSA software engineer discovered that 


the identities of va rious USPs collected under FAA $704 and FAA ^705(b) had been shared wit h 
IC agency analysts I 


implemented onf 


The software revision was 
Recall ottiie mtormation from the it agency was not feasible 


because of its volume and lack of unique identifiers for the FAA records. 
D. (U) Other 

1. (U) Unauthorized Access 


(U/i= eUO 



-- 1 

ran 

queries u 


an NSA analyst detailed to an IC agency accessed an 


NSA/CSS tool and lan^_^queries using an NSA/CSS account instead of an 1C agency account. 


as required by an agreement between NSA/CSS and the 1C agency. The accounts for NSA/CSS 
employee s accessina NSA/tT SS databases at the 1C agency were to have been de-activated by 


land activated by the IC agency 


NSA/CSS 

improper access of the tool was used in reports. 

2 . (U) Consensual Collection 
(U//F©fc^ 


No data from the 


an NSA analyst requested that a selector for a U SP be 
detasked because the t aruet had rescinde d consent for monitoring | The 

selector was de tasked I I The selector had been tasked by NSA/CSS on behalf of 

an IC custoniei f 
the selector after| 


The IC customer confirmed that he had no collection for 


. 


(b)(3)-P.L. 86-36 


(U//F OU e) 


an NSA analyst discovered that targeting of a USP 
continued beyond the period approved by a consensual agreement. The error occurred because 


]the selectors for the target had been incorrectly tasked and had not been removed when 


the agreement expired. No collection occurred between the time of expiration and the time of 
removal, and no reports were issued. (b)(1) 

(b)(3)-P.L, 86-36 

3. (U) Computer Network Exploitation (CNE) (b)(3)-i8 use 798 

' ' (b)(3)-50 use 3024(i) 



(TS ' '/ShVMF) 
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E. (U) Counterintelligence Activities 
(U) Nothing to report, 

F. (U) Intelligence-Related Activities 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18USC 798 
(b)(3)-50 use 3024(i) 


F. (U) Intelligence-Related Activities (b)(1) 

(b)(3)-P.L, 86-36 

(S//SI//NF) To reduce the risk of unauthorized telephony collection and prevent 3024(i) 

violations. NSA/ CSS instituted a process that gives analysis greater and faster insight into a 
laiuet’s location, | I 


I_ 

data was purged from NSA CSS s principal raw traffic repositories where required. 


Collected 


I NSA analysts found I le-mail selectors I I 

| this quarter. Collected data was 

purued from NSA/CSS’s principal raw traffic repositories where required. r>. «« 

(b)(3)-P.L- 00-36 

(U/ /FQUO) In i l instances. database access was not terminated when access v^al^n^o ° 3024(i) 

longer required. Although not viol ations of E O 12333 or related directives, the accesses were 

terminated In addition, there were|_[instances of unauthorized access to raw SIGINT anc | | 

hccount sharing during the quarter. 




(b)(3)-P.L. 86^ 


(U) NSA/CSS Office of the Inspector General (OIG) Intelligence Oversight (10) 
Inspections, Investigations, and Special Studies 


(U//FOUO} During the first quarter ofCY2011. the OIG reviewed various NSA/CSS 
intelligence activities to determine whether they had been conducted in accordance with statutes. 
Executive Orders. Attorney General procedures, and Department ofDefense and internal 
directives. With few exceptions, the problems uncovered were routine and showed that 
operating elements understand the restrictions on NSA/CSS activities. 

A. (U) Expeditionary Operations Reviews (EORs) 

_ (U'/T0U(3tl [ the NSA/CSS OIG and the NSA/CSS Representative to 

proposed EORs of forward cryptologic elements to enhance cryptologic 
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(b)(3)-P.L. 86-36 


operations and provide Agency leadership an independent, on-site assessment of in-theater 
operations. A review was conducted of mission operations and IQ performed by Cryptologic 
Services Groups and Cryptologic Support Teams | 

The 10 review highlighted the need for development of 10 guides that detail 10 procedures and 
for better guidance on 10 functions for Officers in Charge. 



- (b3(3)-P.L. 86-36 


(C//RCL TO USA. rVCV) As part ofthe joint IGinspection of | [ the 10 

inspection team reviewed the 10 program. 10 training, and the application of 10 standards i n the 
SIGINT mission a ctivities performed at the two sites. The 10 programs al l I are 

included under the | | 10 Program and are managed by the j 10 

Program Manager (lOPM). who also serves as the 10 Officer ( 100) F I The 10 programs 
at both sites are well documented an d sustain able The l I Piouiam is healthy, and inspectors 
highlighte d as an a rea of strength the l l lOO's commitment to adherence to compliance 
standar ds. | | mission-related 10 training is timely, appropria te, and respon sive to needs of 

_pers(.uinel Th el J iOPM has worked with the | 10PM and the 100 to 

raise 10 awareness at I (b)(1) 

(b)(1) (b)(3)-P.L. 86-36 

C. (U) Misuse of the U.S, SIGINT System (b)(3)-P.L 86-36 U|C 798^^^^ 

(TS//SI//NF) _ NSA/CSS learned that a SIGINT analyst at a collect ion 

site used the U.S. SIGINT System to target a foieiun national f I Tlie 

analyst tasked the telephone selector ofthe | ^ I 

II I 

I The incident is under investigation by the OlG’s Office of In\ estigation. The analyst 
ha.s been removed from the site. 


(TG//GI//Nr) I I NSA/CSS learned that a SIGINT analyst at a collection site 

performed a query in a raw traffic data base using a personal U.S. tele phone number and the 
telephone number of a foreign national | I The analyst viewed the (t))(1) 

metadata results returned b y the query No tasking, collectio n, or dissemination occurred during^*^)^^)’^ *- 
this incident. The incident. | is under investigation by the OlG's 

Office of Investiuation. 


(b)(3)-P.L 86-36 
(b)(3)-50 use 3024(i) 


' Dur ing an audit review |_| NSA/CSS learned that a military 

analvsl T" l had queried t he U.S. telephone number ofthe son of a persona l 

a aintance in a raw traffic database F I The query results were deleted j 

The analyst has been barred from the secured work area a nd has had clearance s 

suspended. An investigation ofthe incident is being launched by|_ The OlG’s 

Office of Investigation will also investigate this incident. 

D. (U) Congressional and 10 Board Notifications 

4 TS//G I //Nr) | I NSA/CSS notified the Congressional intelligence 

committees of a matter involving the NSA/CSS “upstream” colleaion under FAA §702. In 
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(b)(3)-P.L. 86-36 
(b)(3)-18 use 798 

addition to acquiring Internet communications under FAA §702 to or from a foreign targ^^^^*®® 3024(i) 

electronic communications account from U S. companies that maint ain such accounts. NSA/CSS 
acquires Internet communications to. from, or about aforeian taraet I I 


I These collection 

methods sometimes acquire multiple, logically separate Internet communications that cannot be 
^divided by technical means| | 

I This matter has been described to the FISC, which expressed concerns 
about upstream collection T his mat ter also surfaced during the Court's consideration of 
applicatio ns for renewal of all j | FAA §702 Certifications, which were to expire in June and 

August. 

-f TS/ZSli'/MF ^-The FISC granted a requested extension of all | b f the current 
certifications until 20 September 2011 to permit time for the FISC to complete its review of the 
Government's responses to questions and issue orders on this matter. (b)(1) 

(b)(3)-P.L. 86-36 

E. (U) Other Notifications (b)(3)-50 use 3024(i) 

(S/.i'NFt NSA/CSS has notified the Attorney General of ^consensual and nonconsensual 
intelligence-related collection activities for USP hostage and detainee cases. 


III. (U) Substantive Changes to the NSA/CSS lO Program 
A. (U) Database Access Control Tool 


(b)(1) 

(b)(3)-P.L, 86-36 


(U// F0UO) NSA/CSS is creating atailored data management tool to maintain access 
control of SIGINT data in registered repositories. In the fiiture. NSA/CSS hopes to be able to 
supply more precise information about repositories, users, and the number of queries made in a 
given quarter. 

B. (U) | \ (b)(3)-P.L. 86-36 

(U /4'OUG t l iNSA's Director of Complian ce and the IG jointly hosted a 

town meeting to introduce the new ! i desiuned to automate the 

process of sub mittinu mission compliance incident reports across the worldwide NSA/CSS 
enterprise. Th j I will become the Agency’s central tool for reporting all potential mission 
compliance incidents and will provide such benefits as a streamlined management process, a 
central repository, and metrics data tr> smnnnri mnt ransf identification and trend analysis. T he 
I j is expected to be implemented in_and fully operational for | 

IV. (U) Changes to NSA/CSS Published Directives or Policies Concerning 
Intelligence, Counterintelligence, or Intelligence-Related Activities and the 
Reason for the Changes 

(U) Nothing to report. 
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V. (U) Procedures Governing the Activities ofDoD Intelligence Components that 
Affect USP (DoD Directive 5240.1 -R, Procedure 15} Inquiries or Matters Related 
to 10 Programs 

(U) Nothing to report. 
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